sysctl: treewide: constify ctl_table_root::permissions
Commit Message
The permissions callback is not supposed to modify the ctl_table.
Enforce this expectation via the typesystem.
The patch was created with the following coccinelle script:
virtual patch
virtual context
virtual report
@@
identifier func, head, ctl;
@@
int func(
struct ctl_table_header *head,
- struct ctl_table *ctl)
+ const struct ctl_table *ctl)
{ ... }
(insert_entry() from fs/proc/proc_sysctl.c is a false-positive)
This change also is a step to put "struct ctl_table" into .rodata
throughout the kernel.
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
---
The patch is meant to be merged via the sysctl tree.
This change was originally part of the sysctl-const series [0].
To slim down that series and reduce the message load on other
maintainers to a minimumble, submit this patch on its own.
[0] https://lore.kernel.org/lkml/20231204-const-sysctl-v2-2-7a5060b11447@weissschuh.net/
---
include/linux/sysctl.h | 2 +-
ipc/ipc_sysctl.c | 2 +-
kernel/ucount.c | 2 +-
net/sysctl_net.c | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
---
base-commit: de2ee5e9405e12600c81e39837362800cee433a2
change-id: 20231226-sysctl-const-permissions-d7cfd02a7637
Best regards,
Comments
On Tue, Dec 26, 2023 at 01:08:48PM +0100, Thomas Weißschuh wrote:
> The permissions callback is not supposed to modify the ctl_table.
> Enforce this expectation via the typesystem.
>
> The patch was created with the following coccinelle script:
>
> virtual patch
> virtual context
> virtual report
Nit:
The virtual stuff is not needed really, specially if you are not
creating rules which depend on them, they are used mostly if you
want to use coccicheck, but you could just simplify things further,
by removing them, it is implied we are expected to just run coccinelle
manually against the linux kernel tree.
So the above 3 virtual lines can be removed.
> @@
> identifier func, head, ctl;
> @@
>
> int func(
> struct ctl_table_header *head,
> - struct ctl_table *ctl)
> + const struct ctl_table *ctl)
> { ... }
>
> (insert_entry() from fs/proc/proc_sysctl.c is a false-positive)
>
> This change also is a step to put "struct ctl_table" into .rodata
> throughout the kernel.
>
> Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
> ---
> The patch is meant to be merged via the sysctl tree.
>
> This change was originally part of the sysctl-const series [0].
> To slim down that series and reduce the message load on other
> maintainers to a minimumble, submit this patch on its own.
>
> [0] https://lore.kernel.org/lkml/20231204-const-sysctl-v2-2-7a5060b11447@weissschuh.net/
It does that since the diff stat is small build tests suffice to ensure
in this case that no users exist which do modify the tables.
Luis
@@ -207,7 +207,7 @@ struct ctl_table_root {
void (*set_ownership)(struct ctl_table_header *head,
struct ctl_table *table,
kuid_t *uid, kgid_t *gid);
- int (*permissions)(struct ctl_table_header *head, struct ctl_table *table);
+ int (*permissions)(struct ctl_table_header *head, const struct ctl_table *table);
};
/* struct ctl_path describes where in the hierarchy a table is added */
@@ -190,7 +190,7 @@ static int set_is_seen(struct ctl_table_set *set)
return ¤t->nsproxy->ipc_ns->ipc_set == set;
}
-static int ipc_permissions(struct ctl_table_header *head, struct ctl_table *table)
+static int ipc_permissions(struct ctl_table_header *head, const struct ctl_table *table)
{
int mode = table->mode;
@@ -38,7 +38,7 @@ static int set_is_seen(struct ctl_table_set *set)
}
static int set_permissions(struct ctl_table_header *head,
- struct ctl_table *table)
+ const struct ctl_table *table)
{
struct user_namespace *user_ns =
container_of(head->set, struct user_namespace, set);
@@ -40,7 +40,7 @@ static int is_seen(struct ctl_table_set *set)
/* Return standard mode bits for table entry. */
static int net_ctl_permissions(struct ctl_table_header *head,
- struct ctl_table *table)
+ const struct ctl_table *table)
{
struct net *net = container_of(head->set, struct net, sysctls);